/sys
hardware and drivers/sys is the kernel’s map of the hardware. Like /proc it is made up on demand, but it is organised by device rather than by process. Every network card, disk and USB port is a directory, and each of its properties is a small file holding one value.
/proc is about processes. /sys is about devices.
Why it exists
Every directory at the top of the tree is there for a reason. This is the problem /sys solves.
/proc grew a jumble of hardware information over the years. /sys was added to give devices a consistent layout: one directory per device, one value per file.
Because each property is a file, a shell script can read a battery level or set a screen’s brightness with nothing more than cat and echo.
What you find inside
Not everything, but the entries worth recognising. Each is marked as a directory, a file, a link or a device.
- class/netdirectoryOne entry per network interface, with its MAC address, state and counters.
- blockdirectoryThe disks and their partitions.
- devicesdirectoryEvery device, arranged by how it is connected.
- class/power_supplydirectoryBatteries and mains adapters.
- moduledirectoryThe loaded kernel modules and their parameters.
At the terminal
Four commands that show what this directory is doing on a real machine.
ls /sys/class/netList the network interfaces the kernel knows about.
cat /sys/class/net/eth0/addressRead an interface’s MAC address.
cat /sys/class/net/eth0/operstateRead whether the link is up or down.
cat /sys/block/sda/sizeRead a disk’s size, counted in 512-byte sectors.
Handle with care
What goes wrong here, and what someone securing or attacking the machine looks at.
Writing to a file here can switch a device off or change how it behaves, immediately. Read first; write only when you know what the file controls.
eth0 is the classic name. Current systems use names such as enp3s0 or ens33, so list /sys/class/net before assuming one.